01
Detect
Syspeace Service follows the Windows Security event log for repeated failed sign-in attempts and other suspicious authentication activity, then evaluates it against configurable rules.
Product
Host-level protection with remote operational control.
Windows Server exposes sign-in surfaces — Remote Desktop, Exchange, SharePoint, SQL Server, and more — that attackers probe with repeated automated sign-in attempts. Syspeace Service runs on each protected server, watches for that pattern, and blocks the offending addresses. Syspeace Console gives administrators one place to manage every protected server remotely.
Detection, blocking, management, and reporting are separate concerns.
Each stage of the Syspeace workflow does one job well, and each is visible to the administrator on its own terms.
02
Block
Syspeace v4 blocks offending IP addresses directly through the Windows Filtering Platform, so enforcement keeps working even when Windows Firewall is disabled or managed by other software.
03
Manage centrally
Syspeace Console connects to every protected server through the Syspeace relay, so administrators can review and configure services remotely without direct line-of-sight to the server.
04
Report
Access Log and Access Report give administrators a searchable history of successful and failed sign-in attempts, supporting investigation after a block occurs.
Administer every protected server from one Console.
- Syspeace Console reaches every paired Syspeace Service through the Syspeace relay, so administrators do not need direct network line-of-sight to the server.
- Multiple administrators can run Console at the same time; configuration changes made in one Console propagate to the others.
- Communication between Console and Service is encrypted, and Syspeace Service can be upgraded remotely from Console.
See what happened, and why a block occurred.
- Current blocks — which IP addresses are presently blocked, and why.
- Access Log — a searchable history of successful and failed sign-in attempts, exportable to CSV.
- Access Report — filter and drill into sign-in activity across a protected server.
- IP activity — the rule that triggered a block, and the individual sign-in attempts behind it.
- Daily and weekly email reports summarizing activity.
Built for Windows Server, not general-purpose endpoints.
Syspeace Service is designed for Windows Server. It is not intended or supported for use on Windows client operating systems.
Where Syspeace can help
- Remote Desktop Services (RDP) and Terminal Services sign-ins
- Exchange Server SMTP mail accounts
- File shares and other services using Windows authentication
- Outlook Web Access (OWA)
- Citrix and SharePoint sign-ins
- Microsoft SQL Server sign-in attempts
- Microsoft Routing and Remote Access Service (RRAS) sign-ins
- Website sign-in attempts, using the optional Web Detector
See how this applies to a specific environment on the solutions pages.
Blocking follows rules, not assumptions.
Not every failed sign-in is treated as an attack. Syspeace evaluates activity against configured rules and thresholds before blocking a source — occasional mistyped sign-ins from a legitimate user are a normal, expected part of that pattern, not an automatic block.
Syspeace complements these controls — it doesn't replace them.
- Strong authentication and multi-factor authentication
- Regular patching of Windows Server and hosted applications
- Network segmentation and least-privilege administration
- Account lockout policy
- Endpoint protection and monitoring
- Firewall policy at the network perimeter
Licensed per protected server, per day.
No annual minimum, no rounding up to a fixed plan — choose the servers and dates you need.
See it in your environment
Start a trial, or review what changed in v4.
Install the full Service and Console package on a trial basis, or compare Syspeace v3 and v4 side by side first.